1 Introduction↩︎

Out-of-distribution (OOD) detection seeks to classify whether a data point belongs to a particular domain. It is especially important, because machine learning models typically assume that test-time samples are drawn from the same distribution as the training data. If the test data do not follow the training distribution, they can inadvertently produce non-sensical results. The increased use of machine learning models in high-stake areas, such as medicine [1] and criminal justice [2], amplifies the importance of OOD detection. For example, if a doctor mistakenly inputs a chest X-ray into a brain tumor detector, the model would likely still return a prediction – which would be meaningless and possibly misleading.

Previous researches have studied OOD detection under different settings: supervised and unsupervised. Within the supervised setup, the supervision can originate from different sources. In the most informed setting, one assumes access to representative out-of-domain samples. These allow one to train an OOD detector as a classifier distinguishing in-domain from out-of-domain data, and achieve high performance [3], [4] – as long as the out-of-domain data do not deviate from the assumed out-of-domain distribution. In many practical applications, however, such knowledge is unattainable. In fact, out-of-domain data can be highly diverse and unpredictable. A significantly more relaxed assumption is to only require access to an in-domain classifier or class labels. Under this setting, methods such as  [5]–[9] have achieved competitive performance. Although less informed, this setting relies on two implicit assumptions: the in-domain data have well-defined classes, and there are sufficiently plenty data with class annotations. In practice, these assumptions often cannot be met. Unlabeled data do not require the expensive human annotation, and thus are often readily available in large quantity. Ideally, one would like to build an OOD detector that only requires unlabeled in-domain data during training.

Recently, a class of generative models – the diffusion models (DM) [10], [11] – have gained increasing popularity. DMs formulate two processes: The forward process converts an image to a sample drawn from a noise distribution by iteratively adding noise to its pixels; the backward process maps a noise image towards a specific image manifold by iteratively removing noise from the image. A dedicated neural network is trained to perform the denoising steps in the backward process.

In this paper, we argue that we can leverage the property that the diffusion model learns a mapping to a manifold, and turn it into a strong unsupervised OOD detector. Intuitively, if we lift an image from its manifold, then the lifted image can be mapped back to its original vicinity with a diffusion model trained over the same manifold. If instead the diffusion model is trained over a different manifold, it would attempt to map the lifted image towards its own training manifold, causing a large distance between the original and mapped images. Thus, we can detect out-of-domain images based on such distance.

To this end, we propose a novel unsupervised OOD detection approach called Lift, Map, Detect () that captures the above intuition. We can lift an image from its original manifold by corrupting it. For example, a face image masked in the center clearly does not belong to the face manifold anymore. As shown by [11], [12], the diffusion model can impute the missing regions of an image with visually plausible content, a process commonly referred as inpainting, without retraining. Thus, we can map the lifted image by inpainting with a diffusion model trained over the in-domain data. We can then use a standard image similarity metric to measure the distance between the original and mapped images, and detect an out-of-domain image when we observe a large distance. Figure 1 illustrates an example: A diffusion model trained on face images maps a lifted in-domain face image closer to the original image than an out-of-domain fire hydrant counterpart.

To summarize our contributions:

1. We propose a novel approach for unsupervised OOD detection, which directly leverages the diffusion model’s manifold mapping ability without retraining. We introduce design choices that improve the separability between in-domain and out-of-domain data.

2. We show that is versatile through experiments on datasets with different coloring, variability and resolution.

3. We provide qualitative visualization and quantitative ablation results that verify the basis of our approach and our design choices.

2 Background↩︎

Unsupervised OOD Detection. We formalize the unsupervised OOD detection task as follows: Given a distribution of interest \(\mathcal{D}\), one would like to build a detector that decides whether a data point \(\mathbf{x}\) is drawn from \(\mathcal{D}\). The detector is only built upon unlabeled in-distribution samples \(\mathbf{x_1}, \cdots, \mathbf{x_n} \sim \mathcal{D}\). Given a test data point \(\mathbf{x}\), the detector outputs an OOD score \(s(\mathbf{x})\), where a higher \(s(\mathbf{x})\) signifies that \(\mathbf{x}\) is more likely not to be sampled from \(\mathcal{D}\).

Existing works can be roughly divided into three categories: likelihood-based, reconstruction-based, and feature-based. Likelihood-based approaches date back to [13]. At a high level, one fits the in-domain distribution with a model, and evaluates the likelihood of the test data under the model. Recent approaches often employ a deep generative model that supports likelihood computation, such as PixelCNN++ [14] or Glow [15]. However, several works [16]–[18] have found that generative models sometimes assign higher likelihood to out-of-domain data.

This issue can be alleviated in various ways. One line of work adopts a likelihood ratio approach: [19] trains a semantic model and a background model, and takes the ratio of the likelihoods from the two models.  [20] observes a negative correlation between an image’s complexity and its likelihood, and adjusts the likelihood by the compression size.  [21] optimizes the model configuration to maximize a test image’s likelihood, and measures the amount of likelihood improvement. Another line of work adopts a typicality test approach [22]–[24]. They examine the distribution of in-domain likelihood or other model statistics, and evaluate the typicality of the test data model statistics through hypothesis testing or density estimation. Lastly, several works [18], [25] seek to improve the design choices of generative models.

Reconstruction-based approaches evaluate how well a data point can be reconstructed by a model learned over the in-domain data. Our approach falls into this category. Within this line of work, [26]–[29] encode and decode data with autoencoders. [30], [31] perform GAN [32] inversion for a data point, and evaluate its reconstruction error and discriminator confidence under the inverted latent variable. Additionally, concurrent to our work, [33] leverages diffusion models to reconstruct images at varied diffusion steps, while we mask and inpaint an image repeatedly with fixed steps. The two approaches are complementary to each other.

Feature-based approaches featurize data in an unsupervised manner, and fit a simple OOD detector like a Gaussian Mixture Model over the in-domain features. [34] leverages the latent variables of an autoencoder, and evaluates the Mahalanobis distance in the latent space along with the data reconstruction error. [35] extracts low-level features from the encoder of an invertible generative model. [36]–[39] learn a representation over the in-domain data through self-supervised training; [40] further shows that one can instead use a strong pretrained feature extractor while maintaining comparable performance.

Diffusion Models. In this section, we provide a brief overview of the diffusion models (DM). It is a type of generative model that learns the distribution of its training data. DM formulates a forward process of corrupting data by adding noise to them, commonly referred as diffusion. It learns the reverse process of gradually producing a less noisy sample, commonly referred as denoising. One classic formulation of DM is called Denoising Diffusion Probabilistic Models (DDPMs) [10], [41]. Specifically, starting from a data sample \(x_0\), each step \(t = 1, 2, \cdots, T\) of the diffusion process injects Gaussian noise given by \[q(x_t|x_{t-1}) = \mathcal{N}(x_t;\sqrt{1-\beta_t}x_t, \beta_t\mathbf{I})\] where \(\beta_t\) follows a fixed variance schedule. The DDPM with a prior distribution \(x_T \sim \mathcal{N}(0, 1)\) learns the denoising process given by \[p_\theta(x_{t-1}|x_t) = \mathcal{N}(x_{t-1};\mu_\theta(x_t, t), \Sigma_\theta(x_t, t))\] where both \(\mu_\theta(x_t, t)\) and \(\Sigma_\theta(x_t, t)\) are learned by a neural network parametrized by \(\theta\). Note that other formulations of DMs, such as score-based generative models [42] and stochastic differential equations [11], also support diffusion and denoising processes. Since is agnostic to different formulations of DMs, we refer the reader to [43] for a more detailed mathematical description of the other formulations.

3 Lift, Map, Detect↩︎

The intuition behind our algorithm, Lift, Map, Detect (), is illustrated in Figure 1. In a nutshell, we employ a diffusion model learned over the in-domain data, which provides a mapping towards the underlying in-domain image manifold. To test whether an image is in-domain or out-of-domain, we lift the image off its original manifold through corruption, and map the lifted image to the in-domain manifold with the trained DM. If the original image is in-domain, it is mapped back to its manifold, near its original location. If it is out-of-domain, the image is mapped to a different manifold, likely leaving a large distance between the original image and the mapped image. Figure 2 shows the high-level workflow of . Algorithm 4 summarizes the key steps of in pseudocode.

Lifting Images. To lift an image off its manifold, we need to corrupt the image so that it no longer appears to be from its original manifold. Concretely, we apply a mask to the image so that part of it is completely removed. Since various mask patterns and sizes can be used, masking provides a direct and flexible way to lift the image from the manifold. For example, it is intuitive to see that the larger the mask is, the further away the image is lifted from the manifold.

Mapping the Lifted Images. Since diffusion models (DM) can perform inpainting without retraining [11], [12] (see Algorithm 3), we naturally employ a DM and use inpainting to map the lifted images. Specifically, we employ a DM parametrized by \(\theta_{in}\) that is trained on the in-domain data. This DM can model the in-domain distribution well enough to map a lifted in-domain image back to its original vicinity. Meanwhile, the DM should have almost no knowledge about the out-of-domain manifold. Thus, it naturally maps a lifted out-of-domain image towards the DM’s training manifold, which is the in-domain manifold. This phenomenon leads to a larger distance between the original and mapped images for out-of-domain images than the in-domain ones. For ease of reference, we also refer these mapped images as reconstructed images or simply reconstructions.

Reconstruction Distance Metric. We adopt the Learned Perceptual Image Patch Similarity (LPIPS) [44] metric, a standard and strong metric that captures the perceptual difference between images. Since LPIPS assigns higher values to more dissimilar images, we compute the LPIPS between original and reconstructed images, and use it directly as the OOD score. We perform detailed ablation on different reconstruction distance metrics in Section 4.4.

It is worth noting that mapping lifted images is the most crucial component. The hypothesis – in-domain reconstructions are closer to their original images than the out-of-domain ones – ensures the effectiveness of . With this in mind, we now discuss two simple and yet effective ways that can further improve detection performance consistently: multiple reconstructions and novel masking strategy.

Multiple Reconstructions. The DM inpainting process inherently involves multiple sampling steps. Occasionally, due to randomness, DM could provide dissimilar reconstructions for in-domain data, or similar reconstructions for out-of-domain data. This could make the reconstruction distance of the in-domain and out-of-domain images less separable, and hence lead to suboptimal OOD detection performance. To reduce the randomness, we perform multiple lifting and mapping attempts for each image. We calculate the OOD score from each attempt, and take the median¹ OOD score as the final OOD score for an image. As shown in Section 4.3, the simple median aggregation already provides strong performance. For further improvement, one may use a parameterized model to learn the distribution of the reconstruction distance across multiple attempts. We leave this to future work.

Novel Masking Strategy. The extent to which we mask an image is crucial to the detection performance. If the size of the mask is too large (or too small), the reconstruction distance for both in-domain and out-of-domain images would be very large (or very small). Indeed, if the mask covers the entire image, the reconstruction will be independent of the original image. In this case, if the in-domain manifold contains diverse images, an in-domain reconstruction can be far from its original image despite still being on the same manifold. Therefore, a suitable masking strategy should leave enough context to allow in-domain reconstructions to be similar to the original ones. To this end, we propose to use a checkerboard mask pattern. It divides an image into an \(N \times N\) grid of image patches independent of the image size, and masks out half of the patches similar to a checkerboard. When multiple reconstruction attempts are performed, we also invert the masked and unmasked regions at each attempt. We call this masking strategy alternating checkerboard \(N \times N\) (see Figure 5). Alternating checkerboard ensures all regions of the image to be masked with just two attempts. This avoids situations in which the distinguishing features of an out-of-domain image is never masked. by default sets \(N = 8\); ablation study on different mask choices can be found in Table ¿tbl:tab:masks?.

4 Experiments↩︎

4.1 Experiment Settings↩︎

Evaluation Metric. outputs an OOD score for each input, so in practice we need to apply a threshold to binarize the decision. In the experiments, we follow [5], [19], [40], and use the area under Receiver Operating Characteristic curve (ROC-AUC) as our quantitative evaluation metric.

Baselines. We compare our methods with seven existing baselines: Likelihood (Likelihood)  [13], Input Complexity (IC) [20], Likelihood Regret (LR) [21], Pretrained Feature Extractor + Mahalanobis Distance (Pretrained) [40], Reconstruction with Autoencoder and Mean Squared Error loss (AE-MSE), AutoMahalanobis (AE-MH) [34] and AnoGAN (AnoGAN) [30]. Likelihood is obtained from the DM using the implementation from [11]². For both Input Complexity and Likelihood Regret, we adapt the official GitHub repository of Likelihood Regret³. Specifically, to compute the Input Complexity, we use the likelihood calculated from the DM for a fair comparison, and convert the compression size to bits per dimension; we use the PNG compressor, because it yields the best performance among all available compressors in the GitHub repository. Pretrained Feature Extractor + Mahalanobis Distance is implemented by ourselves, as there is no existing publicly available implementation to our best knowledge.

Datasets. We perform OOD detection pairwise among CIFAR10 [45], CIFAR100 [45] and SVHN [46], and pairwise among MNIST [47], KMNIST [48] and FashionMNIST [49]. For and all the baselines, we use the training set of the in-domain dataset to train the model if needed, and evaluate the performance on the full test set of in-domain and out-of-domain datasets. Additionally, to demonstrate our performance on higher resolution images, we show qualitative results on CelebA-HQ [50] as in-domain and ImageNet [51] as out-of-domain.

\begin{table}[h]

-0.1in \end{table}

4.2 Implementation Details of↩︎

We adapt the diffusion model implementation from [11]. For experiments in Table ¿tbl:tab:main?, we use [11]’s pretrained checkpoint for CIFAR10, and we train DMs on the training set of the in-domain dataset for all the other datasets. We evaluate the OOD scores of the full in-domain and out-of-domain test sets. The inpainting reconstruction is repeated 10 times with alternating checkerboard \(8\times 8\) masks (Figure 5). For CelebA-HQ vs. ImageNet, we observe that CelebA-HQ does not have a train/test set split, and its pretrained checkpoint is trained over the full dataset. Thus, to avoid potential memorization issues, we use the pretrained FFHQ [52] checkpoint instead. We randomly sample a subset of size 100 from each dataset, and standardize all images to \(256 \times 256\). We explore three mask choices: checkerboard \(4\times 4\), checkerboard \(8 \times 8\), and a square-centered mask. We reconstruct each image only once. We use LPIPS as the reconstruction distance metric to calculate the OOD score for all the experiments.

4.3 Experimental Results↩︎

Table ¿tbl:tab:main? shows the performance of and the baselines on various pairs of datasets. achieves the highest performance on five pairs, with a maximum improvement of 10% (CIFAR100 vs. SVHN). also achieves competitive performance on several other pairs, and attains the highest average ROC-AUC. This shows that is consistent and versatile. We observe that the performance of the baselines are competitive on some pairs but limited on the others.

Figure 7 shows examples of the original, masked and inpainted images for three pairs. We show four reconstruction examples for each image, two with checkerboard mask and two with inverted checkerboard mask. The diffusion models reconstruct the in-domain images relatively accurately, while introducing a lot of artifacts in the out-of-domain inpaintings. For example, when SVHN is out-of-domain, the noise almost overwhelms the signals in the inpaintings.

Figure 8 shows the qualitative results and the ROC-AUC for CelebA-HQ vs. ImageNet. Checkerboard \(8\times 8\) performs competitively, achieving an ROC-AUC of 0.991 without any repeated reconstructions. Visually, the in-domain inpaintings look almost identical to the original images, while the out-of-domain inpaintings are locally incoherent. In this specific setting, checkerboard \(4\times 4\) and center masks yield slightly better performance. This is probably because faces are highly structured and provide a strong inductive bias. Thus, with larger contiguous masked regions, the DM can still produce reasonably authentic reconstructions for the in-domain images, while being able to introduce more obvious artifacts for the out-of-domain images. Consequently, the reconstruction qualities of the two domains are more distinguishable. More discussion on mask choices can be found in Section 4.4.

4.4 Ablation↩︎

Effects of Mask Choices. Table ¿tbl:tab:masks? shows ablation results on different types of mask patterns (see Figure 6). Specifically, we examine the following patterns: alternating checkerboard \(4 \times 4\) and \(16 \times 16\), a fixed non-alternating \(8 \times 8\) checkerboard, a square centered mask covering one-fourth of an image (center), and a random patch mask covering 50% of an \(8 \times 8\) patch grid (random patch) introduced in [53]⁴.

Alternating checkerboard \(8 \times 8\) performs consistently across the three datasets, while other patterns have fluctuation in their performance. Not surprisingly, the center mask exhibits very poor performance (0.444) on MNIST vs. KMNIST, as it removes too much information from the images. Alternating checkerboard \(4 \times 4\) also underperforms on MNIST vs. KMNIST. This suggests that if the masked patches are too large, both in-domain and out-of-domain reconstructions may be dissimilar from the original images. Fixed checkerboard \(8 \times 8\) performs only slightly worse than its alternating counterpart, usually with a performance drop of less than 0.01. This may be because for these datasets, the distinguishing features of the in-domain and out-of-domain images exist in many patches. Thus, they can already be captured well enough by the fixed \(8 \times 8\) mask. Nevertheless, the alternating checkerboard pattern should still be preferred, since it can mask the entire image across multiple reconstruction attempts.

Effects of Reconstruction Distance Metrics. needs to assess the reconstruction distance of the DM’s inpaintings, so we explore three off-the-shelf reconstruction distance metrics: Mean Squared Error (MSE), Structural Similarity Index Measure (SSIM) [54], and Learned Perceptual Image Patch Similarity (LPIPS) [44]. Additionally, [40] demonstrates strong performance using SimCLRv2 [55] representations, so we experiment with a SimCLRv2-based error metric too. Specifically, we calculate the cosine distance between the SimCLRv2 representations of the original and reconstructed images, which we simply refer to as SimCLRv2. These four reconstruction distance metrics range from shallow reference based to deep feature based metrics.

We summarize the results of three dataset pairs in Table ¿tbl:tab:metrics?. LPIPS is competitive on all three dataset pairs, while MSE, SSIM, and SimCLRv2 fluctuate in their performance. Interestingly, on CIFAR10 vs. CIFAR100, SimCLRv2 outperforms other metrics significantly, with an improvement of 0.09. In Table ¿tbl:tab:main?, [40] also outperforms all other methods on CIFAR10 vs. CIFAR100 using SimCLRv2 representations. This suggests that other metrics may be suitable for specific domains, and LPIPS serves as an effective default choice for the distance metric.

Number of Reconstruction Attempts per Image. We also study the effect of the number of reconstruction attempts on the performance. Figure 9 shows the ROC-AUC from one attempt to ten attempts per image for two pairs of datasets. In both dataset pairs, increasing the number of attempts almost always improves the ROC-AUC. The improvement is especially significant initially, and saturates at around ten attempts. The improvement is consistent across all four distance metrics, further supporting the effectiveness of ’s multiple reconstructions approach.

\begin{table}[h]

-0.1in \end{table}

Alternative Way of Lifting and Mapping. Alternatively, we can lift an image by diffusion, and map it by denoising. Table ¿tbl:tab:denoising? shows the performance of our OOD detection framework under this instantiation on three dataset pairs. In our experiments, we add noise to step \(t=500\) in each attempt (where \(T=1000\)), as it generally yields good results. Similar to our inpainting setting, we perform 10 attempts per image, and use the median reconstruction error under LPIPS as the OOD score. We observe that diffusion/denoising is also competitive, although it is slightly outperformed by masking/inpainting. This indicates that our framework is generally applicable in OOD detection, and supports various promising alternative instantiations.

5 Discussion and Conclusion↩︎

One limitation of the vanilla diffusion model is that the denoising process involves many iterations and is thus slow. Consequently, like many DM-based algorithms in other applications [12], [56], is hard to be applied to real-time OOD detection at the current stage. Recently, there has been a popular line of work on speeding up diffusion models without retraining. For example, [57] re-scales the noise schedule to skip sampling steps, [58] proposes pseudo numerical methods for diffusion models, and [59] optimizes fast samplers that enable sampling with only 10-20 steps. This opens up a promising direction for future work to integrate these methods into .

In conclusion, we leverage the diffusion model’s manifold mapping ability, and propose a method – Lift, Map, Detect (LMD) – for unsupervised OOD detection. We show that it is competitive and versatile through our experiments.

6 Acknowledgement↩︎

This research is supported by grants from DARPA AIE program, Geometries of Learning (HR00112290078), the Natural Sciences and Engineering Research Council of Canada (NSERC) (567916), the National Science Foundation NSF (IIS-2107161, III1526012, IIS-1149882, and IIS-1724282), and the Cornell Center for Materials Research with funding from the NSF MRSEC program (DMR-1719875).

References↩︎